Automatic Sync of AD and Live@edu username AND passwords

[Tricky_Dicky]

Hi,

 

I'm trying to decide what is the simplest way of implementing the syncing of user names and passwords between AD and Live@edu. Originally I was looking at ILM, but that appears to have been discontinued and replaced with Forefront Identity Manager 2010, which is £1895 for the licence and another £2.60 per cal, which seems a crazy number to me.

 

Is there anyway of doing it with scripts?

 

Regards

Rich

[nadeem]

there should be a special educational licence that only lets you use FIM just for live@edu stuff (or at least there was for ILM)

[AngryTechnician]

According to Microsoft's Live@edu specialists, ILM 2007 is still the one to use, but like you I'm having trouble getting quotes for it because all the resellers think they should be selling FIM which has a completely different licence model, and has no education version. Will let you know if and when someone gets back to me with an SKU!

[Tricky_Dicky]

Yes there used to be a discount for ILM but Forefront is the only one that I can get a price for.

 

This might sounds stupid but Forefront Threat Management Gateway is a completely different product isn't it? Only ask because our reseller seems to think it might be similar to ILM and is only £223 per processor licence.

[AngryTechnician]

Forefront Threat Management Gateway is a completely different product. The problem with a lot of Microsoft resellers is they really don't know the (increasingly complicated) product catalogue very well and they get stumped by any request that is remotely out of the ordinary.

 

I have been assured by Microsoft that is still possible to buy ILM, so I am still pursuing that at present.

[gshaw]

Yup ILM is the only way as it stands as the agent hasn't been rewritten for FIM.

 

There's a big suite of Forefront-branded products now but the some of the names don't always make it obvious what they do at first glance

 

One thing with the password sync... it's only password changes so if you issue an initial password to users it won't work on Live@Edu until it's been changed on the network.

[RabbieBurns]

Cant really add anything else, gshaw's post covers everything you need to know...

[Tricky_Dicky]

Thanks for the info guys. I'm still having trouble getting a copy though.

 

I can buy the physical media but the licencing is raving money. Can anyone recommend some where that I can purchase it from and an idea of cost.

 

Rich

[RabbieBurns]

Try posting in the Suppliers forum, perhaps some of them have a clue about MS .edu licensing?

 

Basically the ILM license for live@edu restricts you to use ILM for the sole purpose of live@edu and you cannot use it.

 

We paid $200AU for it. Not really useful to give you my suppliers I guess.. Perhaps PM the Ray guy from MS who posts here..

[Tricky_Dicky]

Have found a supplier. Tempus will do it for £235.

[PiqueABoo]

I'm hoovering up real info so thanks for posting that price.

 

Is there anyway of doing it with scripts?

 

FWIW I thought about this and it will always take code: You have to make some kind of PasswordChangeNotify() agent DLL to run on each DC to capture passwords when they are changed and safely put them somewhere central for later use - presumably that's what ILM does for you. Then you've got to make the app to talk to AD, that changed password store and sync Live@Edu - which is presumably what OLSync does. A fair bit of work to make it seriously robust, and all in all a couple of hundred quid for MS to carry-the-can seems much easier.

 

I'm still thinking about the viability of making some app to do syncing that doesn't involve (require) passwords for a shared address space scenario i.e. just needs to make [unmake] mailboxes and mail-users at one end or the other.

 

--

 

Dear folk who have ILM in production,

 

What are the general ILM overheads like i.e. if you had to squish it onto an existing server how much would that hurt? I'm assuming the SQL instance doesn't hold much data and isn't too big, is that the case? Or if you've made a dedicated VM for it, what kind of "size" is it (+rough number of AD accounts)?

[AngryTechnician]

Have found a supplier. Tempus will do it for £235.

 

Don't suppose you could post the SKU number of what they quoted could you?

[RabbieBurns]

I run ILM and SQL on a virtual server each, 1gb ram and about 80gb disk.. overkill with the HDD space I reckon.. MS recommended best practice is to have ILM and SQL sitting on the same server, but at out 2500 users theres no delay or lag..

 

What would be nice though, talking of writing custom software, would be a Exchange Managment Conslole equivelent front end, for managing it. ILM takes care of accounts and password creation / sync, but the web based control panel of live@edu is very limited. If you want to make changes which are not available in the web gui, you have to resort to powershell.

 

So if anyone wants to write a EMC style frontend for live@edu, please do!

[RabbieBurns]

Don't suppose you could post the SKU number of what they quoted could you?

 

4GN-00080 	ILMSvr ALNG LicSAPk MVL Live 

 

taken from our licensing docs, not sure if thats what your afteR?

[Tricky_Dicky]

Don't suppose you could post the SKU number of what they quoted could you?

 

I don't I'm afraid.

 

Going to get this and put it on a standard server and get working. It's a shame it can't do the initial sync with passwords. It isn't a problem for the teachers but will make it trickier for the kids.

[PiqueABoo]

If you want to make changes which are not available in the web gui, you have to resort to powershell.

 

No so different from normal Exchange really, except there I generally only use powershell for some one-off config. Are you finding that you need to routinely resort to powershell for Live@Edu, and if so, to do what kind of things?

 

It's a shame it can't do the initial sync with passwords.

 

It's basic Windows security architecture preventing that.. unless you once went well out of your way to change this they're stored via irreversible encryption... that password change notification API is one of the few places you can get to the plaintext versions of passwords that are needed here. I suppose in principle you could crack all the kids passwords and then set those with powershell + CSV, but I definitely wouldn't touch that without formal written permission from the Head/whatever, and some kids might have too-good passwords that don't fall out.

[jamesbmarshall]

Although this looks to have sorted itself out, I can say with certainty that you definitely can still get hold of Identity Lifecycle Manager 2007, and there is a specific version for use with Live@edu with a lower price attached (ILMSvr 2007 SNGL MVL Live).

 

If your reseller is telling you that's not the case get back to them and push them on it.

[RabbieBurns]

No so different from normal Exchange really, except there I generally only use powershell for some one-off config. Are you finding that you need to routinely resort to powershell for Live@Edu, and if so, to do what kind of things?

 

To be honest, no. Not touched ILM for a couple of months now.. it just does its thing.

 

I had to use a lot of powershell to get our unique(ish) setup working 100% and a lot of that is even undocumented and was provided over the phone.